Machine users¶
Overview¶
F5 Insight machine users provide application programming interface (API) and automation access for services that need to connect without a human login. The F5 Insight authentication service manages these service identities and their credentials.
Machine users can use the API only. They cannot use the F5 Insight UI. Their application roles control API permissions and do not grant root-level system privileges.
Machine users are different from human users, including users who sign in through
an external identity provider. They don’t have a username and password for
interactive sign-in. Instead, each machine user uses a client_id and
client_secret.
Important
Configure the Insight authentication service before you manage machine users.
If the service is unavailable, machine-user management and login endpoints
return a 503 response.
Machine-user roles¶
Assign a machine user an F5 Insight role, such as Admin, Operator, or Viewer. The role controls application-level API permissions.
Machine-user lifecycle¶
Administrators can:
- Create, list, view, update, and delete machine users.
- Assign or change a machine user’s role.
- Rotate a machine user’s client secret.
F5 Insight stores limited lifecycle information, such as the owner, purpose, and expiry date, for reporting. It doesn’t store the client secret.
Warning
Save the client_secret when F5 Insight displays it. The secret is shown
only when the machine user is created or the secret is rotated. If it is
lost, rotate the secret and update the service that uses it.
Machine-user login¶
Machine users authenticate with the OAuth 2.0 client_credentials grant:
- Send the
client_idandclient_secrettoPOST /api/auth/login/machine. - The Insight authentication service validates the credentials and returns an access token.
- Send the access token with subsequent API requests:
Authorization: Bearer <access_token>.
Machine users don’t use refresh tokens. When the access token expires, request
a new one with the client_id and client_secret.